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DETAILED ACTION 

1 . This action is responding to application papers filed on 3-8-2004. 

2. Claims 29 - 48, 55, 58 are pending, Claims 1 - 28, 49 - 54 have been cancelled. 
Claims 55, 56 are new. Claims 29, 42, 55 are independent. 

Response to Arguments 

3. Applicant's arguments filed 10/24/2007 have been fully considered but they are 
moot due to new grounds of rejection. 

Responses: 

3.1 The USC 1 1 2 rejections have been withdrawn. 

3.1 Applicant argues that the referenced prior art does not disclose, VPN monitoring. 
Aielio prior art discloses VPN data packet monitoring to detect non-VPN traffic. 

(see Aielio paragraph [0007], lines 1-6; paragraph [0009], lines 1-5: data exchange over 
a secure channel such as a VPN tunnel, can be monitored to detect potential security 
breaches; monitor module) 

3.2 Applicant argues that the referenced prior art does not disclose, prohibit 
permanent writing to permanent storage. 

Harrison prior art discloses a prohibition of permanent writing on the client system 
of a VPN tunnel, (see Harrison col. 6, lines 28-31 : provide client side persistent 
storage for untrusted clients; col. 4, lines 60-66: access to storage for client system; 
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storage integrity and security if removed from programmer : col. 5, lines 46-48: data 
repository size; col. 5, lines 52-55: expiration of predefined time period; temporary file 
(no writes to permanent storage on client system)) 

3.3 After an additional analysis of the applicant's invention, remarks, and a search of 
the available prior art, it was determined that the current set of prior art consisting of 
Aiello (200401 231 39), Harrison (6,691 ,113) and Cheline (20030041 1 36) disclose the 
applicant's invention. 

Claim Rejections - 35 USC § 103 

4. The following is a quotation of 35 U.S.C. 1 03(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

a) A patent may not be obtained though the invention is not identically disclosed or described as set forth in 
section 102 of this title, if the differences between the subject matter sought to be patented and the prior art 
are such that the subject matter as a whole would have been obvious at the time the invention was made 
to a person having ordinary skill in the art to which said subject matter pertains. Patentability shall not be 
negatived by the manner in which the invention was made. 

5. Claims 29 - 48, 55, 56 are rejected under 35 U.S.C. 103 (a) as being 
unpatentable over Aiello et al. (US PGPUB No. 20040123139) in view of Harrison et aL 
(US Patent No. 6,691,113) and further in view of Cheline et al. (US PGPUB No. 
20030041136). 

Regarding Claim 29, Aiello discloses a method for reducing vulnerability of a Virtual 
Private Network (VPN) protected network to attack by an end system, comprising the 
steps of: 
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while permitting the access: 

b) continuously monitoring on the end system; (see Aiello paragraph [0007], 
lines 1-6; paragraph [0009], Sines 1-5: data exchange over a secure channel 
such as a VPN tunnel, can be monitored to detect potential security breaches; 
monitor module) 

c) continuously monitoring on the end system for traffic on the end system and 
filtering detected traffic inbound to the end system that is not on the VPN 
connection; (see Aiello paragraph [0020], lines 3-7: packets are filtered and 
monitored to detect packets that do not meet security protocol requirements 
for a secure channel; paragraph [0009], lines 1-6: detect non-VPN traffic) 

d) continuously monitoring on the end system for termination of the VPN 
connection, (see Aiello paragraph [0007], lines 1-6; paragraph [0009], lines 1- 
5: data exchange over a secure channel such as a VPN tunnel, can be 
monitored to detect potential security breaches; monitor module (data 
exchange indicating session termination)) 

Aiello does not specifically disclose attempted writes to the end system and 
preventing attempted writes to permanent memory on the end system. 
However, Harrison discloses attempted writes to the end system, preventing 
detected attempted writes to permanent memory on the end system and purging 
temporary memory on the end system in response to detected termination of the 
VPN connection, (see Harrison col. 6, lines 28-31 : provide client side persistent 
storage for untrusted clients; col. 4, lines 60-66: access to storage for client system; 
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storage integrity and security if removed from programmer : col. 5, lines 46-48: data 
repository size; col. 5, lines 52-55: expiration of predefined time period; temporary 
file (no writes to permanent storage on client system)) 

It would have been obvious to one of ordinary skill in the art to modify Aiello for 
attempted writes to the end system, preventing detected attempted writes to 
permanent memory and purging temporary memory on the end system as taught by 
Harrison. One of ordinary ski!! in the art would have been motivated to employ the 
teachings of Harrison in order to aiiow untrusted applets to have access to persistent 
storage without compromising the integrity of the client computer system, (see 
Harrison col. 4, lines 60-62: " ... A benefit of the present invention is that it aiiows 
untrusted applets to have access to persistent storage without compromising the 
integrity of the client computer system. ...") 

Aiello discloses wherein permitting access by an end system to a VPN protected 
network on at least one VPN connection for a user of the end system to the VPN 
protected network, (see Aiello paragraph [0007], iines 1-6; paragraph [0009], lines 1- 
5: data exchange over a secure channel such as a VPN tunnel, can be monitored to 
detect potential security breaches; monitor module) Aiello does not specifically 
disclose authenticating a user of the end system. 
However, Cheline discloses: 

a) authenticating a user of the end system; {see Cheline paragraph [0049], lines 1- 
10: user authenticated; paragraph [0049], lines 11-14: permit access (encrypted 
packets transferred) to end system) 
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It would have been obvious to one of ordinary skill in the art to modify Aiello for 
authenticating a user of the end system as taught by Cheline. One of ordinary skill 
in the art would have been motivated to employ the teachings of Cheline in order to 
provide a less complex, less efficient, and less costly method for configuring a VPN 
is provided, (see Cheline paragraph [0017], lines 1-5: "... Using the above, a less 
complex, less efficient, and less costly method for configuring a VPN is provided, 
thereby allowing the resources of a service provider to be redirected to areas other 
than manually configuring the system. ... ") 



Regarding Claims 30, 43, Aiello discloses the method, end system of claims 29, 42, 
wherein continuous monitoring, (see Aiello paragraph [0007], lines 1-8; paragraph 
[0009], lines 1-5: data exchange over a secure channel such as a VPN tunnel, can be 
monitored to detect potential security breaches; monitor module) Aiello does not 
specifically discloses the step of attempted writes to the end system further comprising 
redirecting to temporary memory detected attempted writes to permanent memory. 
However, Harrison discloses wherein the step of attempted writes to the end system 
further comprises redirecting to temporary memory detected attempted writes to 
permanent memory, (see Harrison col. 6, lines 28-31: provide client side persistent 
storage for untrusted clients; col. 4, lines 60-66: access to storage for client system; 
storage integrity and security if removed from programmer : col. 5, lines 46-48: data 
repository size; col. 5, lines 52-55: expiration of predefined time period; temporary file 
(no writes to permanent storage on client system)) 
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It would have been obvious to one of ordinary skiil in the art to modify Aielio for 
attempted writes to permanent memory redirected to temporary memory as taught by 
Harrison. One of ordinary skiil in the art would have been motivated to employ the 
teachings of Harrison in order to allow untrusted applets to have access to persistent 
storage without compromising the integrity of the client computer system, (see 
Harrison col. 4, lines 60-62) 

Regarding Claims 31, 44, Aielio discloses the method, end system of claims 29, 42 
wherein the step of continuously monitoring for traffic on the end system comprises 
filtering detected traffic outbound from the end system that is not on the VPN 
connection, (see Aielio paragraph [0009], lines 1-6: monitor module detects non-VPN 
packets) 

Regarding Claims 32, 45, Aielio discloses the method, end system of claims 29, 42. 

(see Aielio paragraph [0007], lines 1-6; paragraph [0009], lines 1-5: data exchange over 
a secure channel such as a VPN tunnel, can be monitored to detect potential security 
breaches; monitor module) Aielio does not specifically disclose before permitting the 
access, the step of denying network access except for performing user authentication. 
However, Cheline discloses further comprising, before permitting the access, the step of 
denying network access except for performing user authentication, (see Cheline 
paragraph [0043], lines 1-8; paragraph [0069], lines 4-1 1 : access only after user 
authentication) 
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It would have been obvious to one of ordinary skill in the art to modify Aieilo for the 
step of denying network access except for performing user authentication as taught by 
Cheline. One of ordinary skill in the art would have been motivated to employ the 
teachings of Cheline in order to provide a less complex, less efficient, and less costly 
method for configuring a VPN is provided, (see Cheline paragraph [0017], lines 1-5) 

Regarding Claim 33, Aieilo discloses the method of claim 29, wherein the monitoring 
steps are performed by the end system, (see Aieilo paragraph [0010], lines 1-4: module 
or filter modules are co-located on one or more of the tunnel hosts (end systems)) 

Regarding Claim 34, Aieilo discloses the method of claim 33, wherein the monitoring 
steps are performed by software having instructions executable by a processor, (see 
Aieilo paragraph [0054], lines 1-3: crypto modules and monitors (software modules) can 
be done in hardware or software) 

Regarding Claims 35, 46, Aieilo discloses the method, end system of claims 34, 42, 
wherein the software is embedded in permanent memory, (see Aieilo paragraph [0054], 
lines 1-3: monitors done (implemented) in software; paragraph [0048], lines 7-14: 
tunnels hosts include various computers and workstations running any number of 
operation systems: portable computers (permanent memory used to hold operational 
software for portable computers)) 
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Regarding Claims 36, 47, Aiello discloses the method, end system of claims 35, 42, 
wherein the software, (see Aiello paragraph [0054], lines 1-3: monitors done 
(implemented) in software; paragraph [0048], lines 7-14: tunnels hosts include various 
computers and workstations running any number of operation systems; portable 
computers) Aiello does not specifically disclose being adapted to inhibit modification 
of the software by the user. However, Harrison discloses wherein adapted to inhibit 
modification of the software by the user, (see Harrison col. 6, lines 28-31 : provide client 
side persistent storage for un trusted clients; col. 4, lines 60-66: access to storage for 
client system; storage integrity and security if removed from programmer : col. 5, lines 
46-48: data repository size; col. 5, lines 52-55: expiration of predefined time period; 
temporary file (no writes to permanent storage on client system; no modification of 
software on permanent storage by user)) 

It would have been obvious to one of ordinary skill in the art to modify Aiello 
whereby adapted to inhibit modification of the software by the user as taught by 
Harrison. One of ordinary skill in the art would have been motivated to employ the 
teachings of Harrison in order to allow untrusted applets to have access to persistent 
storage without compromising the integrity of the client computer system, (see Harrison 
col. 4, lines 60-62) 

Regarding Claim 37, Aiello discloses the method of claim 29. (see Aiello paragraph 
[0007], lines 1-6; paragraph [0009], lines 1-5: data exchange over a secure channel 
such as a VPN tunnel, can be monitored to detect potential security breaches; monitor 
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module) Aiello does not specifically disclose the step of monitoring for termination by 
logging-off the user in response to detected termination of the VPN connection. 
However, Cheline discloses wherein the step of monitoring for termination further 
comprises logging-off the user in response to detected termination of the VPN 
connection, (see Cheline paragraph [0076], lines 1-5: relogon, restarting end system) 

It would have been obvious to one of ordinary skill in the art to modify Aiello for 
logging-off the user in response to detected termination of the VPN connection as 
taught by Cheline. One of ordinary skill in the art would have been motivated to employ 
the teachings of Cheline in order to provide a less complex, less efficient, and less 
costly method for configuring a VPN is provided, (see Cheline paragraph [0017], lines 
1-5) 



Regarding Claim 38, Aiello discloses the method of claim 29, wherein the step of 
monitoring for termination, (see Aiello paragraph [0007], lines 1-6; paragraph [0009], 
lines 1-5: data exchange over a secure channel such as a VPN tunnel, can be 
monitored to detect potential security breaches; monitor module) Aiello does not 
specifically disclose rebooting the end system in response to detected termination of the 
VPN connection. However, Cheline discloses wherein further comprising rebooting the 
end system in response to detected termination of the VPN connection, (see Cheline 
paragraph [0076], lines 1-5: relogon, restarting end system) 

It would have been obvious to one of ordinary skill in the art to modify Aiello to 
reboot the end system in response to detected termination of the VPN connection as 
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taught by Cheline. One of ordinary skill in the art would have been motivated to employ 
the teachings of Cheline in order to provide a less complex, less efficient, and less 
costly method for configuring a VPN is provided, (see Cheline paragraph [0017], lines 
1-5) 

Regarding Claim 39, Aieiio discloses the method of claim 29, wherein the step of 
monitoring for termination, (see Aieiio paragraph [0007], lines 1-6; paragraph [0009], 
lines 1-5: data exchange over a secure channel such as a VPN tunnel, can be 
monitored to detect potential security breaches; monitor module) Aieiio does not 
specifically disclose shutting down the end system in response to detected termination 
of the VPN connection. However, Cheline discloses wherein further comprises shutting 
down the end system in response to detected termination of the VPN connection, (see 
Cheline paragraph [0076], lines 10-14: VPN disconnected, tunnel torn down) 

It would have been obvious to one of ordinary skill in the art to modify Aieiio for 
shutting down the end system in response to detected termination of the VPN 
connection as taught by Cheline. One of ordinary skill in the art would have been 
motivated to employ the teachings of Cheline in order to provide a less complex, less 
efficient, and less costly method for configuring a VPN is provided, (see Cheline 
paragraph [0017], lines 1-5) 

Regarding Claim 40, Aieiio discloses the method of claim 29. (see Aieiio paragraph 
[0007], lines 1-6; paragraph [0009], lines 1-5: data exchange over a secure channel 
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such as a VPN tunnel, can be monitored to detect potential security breaches; monitor 
module) Aieilo does not specifically disclose flash memory. However, Cheline 
discloses wherein permanent memory comprises a flash memory, (see Cheline 
paragraph [0047], lines 16-17; paragraph [0057], lines 3-5: flash memory) 

It would have been obvious to one of ordinary skill in the art to modify Aieilo for 
permanent memory comprising a flash memory as taught by Cheline. One of ordinary 
skill in the art would have been motivated to employ the teachings of Cheline in order to 
provide a less complex, less efficient, and less costly method for configuring a VPN is 
provided, (see Cheline paragraph [0017], lines 1-5) 

Regarding Claim 41 , Aieilo discloses the method of claim 29. (see Aieilo paragraph 
[0007], lines 1-6; paragraph [0009], lines 1-5: data exchange over a secure channel 
such as a VPN funnel, can be monitored to detect potential security breaches; monitor 
module) Aieilo does not specifically disclose a random access memory (RAM) disk. 
However, Cheline discloses wherein temporary memory comprises a random access 
memory (RAM) disk, (see Cheline paragraph [0047], lines 1-10: permanent type 
memory (RAM) for program such as operating system) 

It would have been obvious to one of ordinary skill in the art to modify Aieilo for a 
random access memory (RAM) disk as taught by Cheline. One of ordinary skill in the 
art would have been motivated to employ the teachings of Cheline in order to provide a 
less complex, less efficient, and less costly method for configuring a VPN is provided, 
(see Cheline paragraph [0017], lines 1-5) 
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Regarding Claim 42, Aielio discloses a VPN capable end system, comprising: 
software stored on the permanent memory, the software having instructions 
executable by the processor while the end system is permitted access to a VPN 
protected network on at least one VPN connection, continuously monitor for 
attempted writes to the end system and to continuously monitor for traffic on the end 
system and filter detected traffic inbound to the end system that is not on the VPN 
connection, (see Aielio paragraph [0007], lines 1-6; paragraph [0009], lines 1-5: 
data exchange over a secure channel such as a VPN tunnel, can be monitored to 
detect potential security breaches; monitor module) 

Aielio does not specifically disclose preventing detected attempted writes to the 
permanent memory and purging temporary memory, 
However, Harrison discloses: 

d) preventing detected attempted writes to the permanent memory and purging the 
temporary memory, (see Harrison col. 6, lines 28-31 : provide client side 
persistent storage for untrusted clients; col. 4, Sines 60-66: access to storage for 
client system; storage integrity and security if removed from programmer : col. 5, 
lines 46-48: data repository size; col. 5, lines 52-55: expiration of predefined time 
period; temporary file (no writes to permanent storage on client system)) 
It would have been obvious to one of ordinary skill in the art to modify Aielio for 
preventing detected attempted writes to permanent memory and purging temporary 
memory as taught by Harrison. One of ordinary skill in the art would have been 
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motivated to employ the teachings of Harrison in order to allow untrusted applets to 
have access to persistent storage without compromising the integrity of the client 
computer system, (see Harrison col. 4, lines 60-62) 

Aiello does not specifically disclose at least one permanent memory, at least one 
temporary memory and at least one processor coupled to the permanent memory 
and the temporary memory. 
However, Cheline discloses: 

a) at least one permanent memory; (see Cheline paragraph [0047], lines 1-10: 
permanent type memory for program such as operating system) 

b) at least one temporary memory; (see Cheiine paragraph [0058], line 1 : 
temporary memory) 

c) at least one processor coupled to the permanent memory and the temporary 
memory; (see Cheiine paragraph [0047], lines 1-3: processor, interface (bus) 
between components) 

d) termination of the VPN connection, (see Cheline paragraph [0071], lines 1-3: 
VPN access to end system enabled; paragraph [0076], lines 1-5: logoff user, 
VPN disconnected or inactive; paragraph [0076], lines 10-14: VPN disconnected, 
tunnel torn down) 

It would have been obvious to one of ordinary skill in the art to modify Aiello for 
at least one permanent memory, at least one temporary memory and at least one 
processor coupled to the permanent memory and the temporary memory and 
termination of the VPN connection as taught by Cheline. One of ordinary skill in the 
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art would have been motivated to empioy the teachings of Cheline in order to 
provide a less complex, less efficient, and less costly method for configuring a VPN 
is provided, (see Cheline paragraph [0017], Sines 1-5) 

Regarding Claim 48, Aielio discloses the end system of claim 42, wherein the software 
further has instructions executable by the processor, (see Aieilo paragraph [0054], lines 
1-3: monitors can be done in software (instructions)) Aielio does not specifically 
disclose that the end system is not permitted the access to facilitate authentication of a 
user of the end system to the VPN protected network. However, Cheline discloses 
wherein while the end system is not permitted the access to facilitate authentication of a 
user of the end system to the VPN protected network, (see Cheline paragraph [0043], 
lines 1 -8; paragraph [0069], lines 4-1 1 : access only after user authentication) 

It would have been obvious to one of ordinary skill in the art to modify Aielio where 
the end system is not permitted the access to facilitate authentication of a user of the 
end system as taught by Cheline. One of ordinary skill in the art would have been 
motivated to employ the teachings of Cheline in order to provide a less complex, less 
efficient, and less costly method for configuring a VPN is provided, (see Cheline 
paragraph [0017], lines 1-5) 

Regarding Claim 55, Aielio discloses a VPN capable end system, comprising: 
a) a plurality of memories consisting of at least one write-protected permanent 
memory and at least one temporary memory (see Cheline paragraph [0047], 
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lines 1-10: permanent type memory for program such as operating system; 
paragraph [0058], line 1 : temporary memory); at ieast one processor coupled to 
the memories (see Cheiine paragraph [0047], lines 1-3: processor, interface 
(bus) between components); 
b) software (see Aieilo paragraph [0054], lines 1-3: monitor implemented in 

software; paragraph [0048, lines 7-14: tunnel hosts include various computers) 
stored in the permanent memory, the software having instructions executable by 
the processor while the end system is permitted access to a VPN protected 
network on at least one VPN connection to continuously monitor traffic on the 
end system and filter detected traffic inbound to the end system that is not on the 
VPN connection, and to continuously monitor for termination of the VPN 
connection, (see Aieilo paragraph [0007], lines 1-6; paragraph [0009], lines 1-5: 
monitor data exchange over a secure channel such as a VPN tunnel, can be 
monitored to detect potential security breaches; monitor module; paragraph 
[0009], lines 1-6: detect non-VPN traffic) 

Aieilo does not specifically disclose attempted writes to the end system and 
preventing detected attempted writes to permanent memory and purging temporary 
memory. However, Harrison discloses wherein monitor for attempted writes to the 
end system and prevent detected attempted writes to the permanent memory and 
purge the temporary memory, (see Harrison col. 6, lines 28-31 : provide client side 
persistent storage for untrusted clients; col. 4, lines 60-66: access to storage for 
client system; storage integrity and security if removed from programmer : col. 5, 
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lines 46-48: data repository size; col. 5, lines 52-55: expiration of predefined time 
period: temporary file (no writes to permanent storage on client system)) 

It would have been obvious to one of ordinary skill in the art to modify Aiello for 
attempted writes to the end system and preventing detected attempted writes to 
permanent memory and purging temporary memory as taught by Harrison. One of 
ordinary skill in the art would have been motivated to employ the teachings of 
Harrison in order to allow untrusted applets to have access to persistent storage 
without compromising the integrity of the client computer system, (see Harrison col. 
4, lines 60-62) 

Aiello does not specifically disclose monitoring for termination of the VPN 
connection. However, Cheline discloses wherein monitoring for termination of the 
VPN connection, (see Cheline paragraph [0076], lines 1-5: logoff user, VPN 
disconnected or inactive; paragraph [0076], lines 10-14: VPN disconnected, tunnel 
torn down) 

It would have been obvious to one of ordinary skill in the art to modify Aiello to 
monitor for termination of the VPN connection as taught by Cheline. One of 
ordinary skill in the art would have been motivated to employ the teachings of 
Cheline in order to provide a less complex, less efficient, and less costly method for 
configuring a VPN is provided, (see Cheline paragraph [0017], lines 1-5) 



Regarding Claim 55, Aiello discloses the end system of claim 55, wherein the software 
further has instructions executable by the processor while the end system is permitted 
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the access to redirect to the temporary memory detected attempted writes to the 
permanent memory, (see Aiello paragraph [0054], Sines 1-3: monitors done 
(implemented) in software; paragraph [0048], Sines 7-14: tunnels hosts include various 
computers and workstations running any number of operation systems; portable 
computers (permanent memory used to hold software portable computers)) 



Conclusion 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Carlton V. Johnson whose telephone number is 571- 
270-1032. The examiner can normally be reached on Monday thru Friday , 8:00 - 
5:00PM EST. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Nasser Moazzami can be reached on 571-272-4195. The fax phone 
number for the organization where this application or proceeding is assigned is 571- 
273-8300. 

Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a 
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USPTO Customer Service Representative or access to the automated information 
system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 
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